Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 16:59
Behavioral task
behavioral1
Sample
511d29788bb51144200080b4340eda6a.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
511d29788bb51144200080b4340eda6a.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
511d29788bb51144200080b4340eda6a.exe
-
Size
42KB
-
MD5
511d29788bb51144200080b4340eda6a
-
SHA1
6f4e95e87cb098cbdf4047d40886b7f9758a13fa
-
SHA256
af2769473f10d154705ebcf6f3417d55e5bb6443ba7f2ea6b3ed4b6afe9c0b6c
-
SHA512
d2f7e494589d274ad299507a853dd33111b9f2f0c3beb835417903c31b5713b2691fb08bf51fc65b60158e940d7c1de4fcf39c079b34c26ce2969121eb5e4fc3
-
SSDEEP
768:Z/txtmFhI9kFtPPDL9ytdBN2POWRTyxkW8wfEJeYKyW6GIxPbPrdW:Z3CfX3/4OO+muxNW61RW
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2776 511d29788bb51144200080b4340eda6a.exe 2776 511d29788bb51144200080b4340eda6a.exe 2776 511d29788bb51144200080b4340eda6a.exe 2776 511d29788bb51144200080b4340eda6a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2776 wrote to memory of 3436 2776 511d29788bb51144200080b4340eda6a.exe 52 PID 2776 wrote to memory of 3436 2776 511d29788bb51144200080b4340eda6a.exe 52 PID 2776 wrote to memory of 3436 2776 511d29788bb51144200080b4340eda6a.exe 52 PID 2776 wrote to memory of 3436 2776 511d29788bb51144200080b4340eda6a.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\511d29788bb51144200080b4340eda6a.exe"C:\Users\Admin\AppData\Local\Temp\511d29788bb51144200080b4340eda6a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436